`winx-rs` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the user Kraded to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available...

RUSTSEC-2023-0115 `acceptxmr-rs` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the user Kraded to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available...

btrfsutil (=0.2.0), btrfsutil-fake (>=0.2.0 <=0.2.0-8324fe2) +15 more potentially affected by unknown CVE via loopdev (>=0.1.3 <=0.4.0)

loopdev CARGO version =0.1.3, =0.2.0, =0.1.0, =0.1.0, =0.6.3, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.5.0, =0.5.0, =0.1.0, =0.1.0, =2.4.2, =3.5.7 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0088...

RUSTSEC-2023-0114 `tiny-server` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the malicious user http-tiny and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download...

`tiny-server` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the malicious user http-tiny and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download...

Malicious code in littest (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b7dbb9d0364d3e2b9efec40fc7a2ecdca02406774e6a4359423e6357cf9647e4 The OpenSSF Package Analysis project identified 'littest' @ 0.3.1 crates.io as malicious. It is considered malicious because: - The package...

GuiNistRs (=0.1.0), a-gpt (>=0.1.0 <=0.4.0) +6489 more potentially affected by CVE-2024-43806 via rustix (=0.38.10)

rustix CARGO version =0.38.10 is affected by a known vulnerability. The following packages have a transitive dependency on rustix and may be impacted: - GuiNistRs =0.1.0 - a-gpt =0.1.0, =0.7.0, =0.1.0, =0.0.1, =0.0.1, =0.3.1, =0.2.4, =0.1.0, =0.3.0 - abstractsocket =0.1.0 - abstrap =0.1.0 and mor...

blurhash-cli (>=0.1.0 <=0.1.1), yozuk-core-skillset (>=0.16.3 <=0.22.11) +1 more potentially affected by CVE-2023-42447 via blurhash (=0.1.1)

blurhash CARGO version =0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on blurhash and may be impacted: - blurhash-cli =0.1.0, =0.16.3, =0.16.0, =0.22.11 Source cves: CVE-2023-42447 Source advisory: OSV:RUSTSEC-2023-0083...

acme-client (>=0.1.0 <=0.2.0), aerial (=0.1.0) +691 more potentially affected by unknown CVE via hpack (>=0.2.0 <=0.3.0)

hpack CARGO version =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.7.0, =0.0.1, =0.1.0, =0.5.0, =0.1.3, =0.1.13 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0084...

PT-2023-36099 · Hpack · Hpack

Name of the Vulnerable Software and Affected Versions: hpack affected versions not specified Description: The hpack crate is no longer maintained. Consider using alternative crates such as fluke-hpack or httlib-huffman. Recommendations: At the moment, there is no information about a newer version...

acme-rs (>=0.1.0 <=0.2.0), apkeep (>=0.6.0 <=0.13.0) +23 more potentially affected by CVE-2023-39914 via bcder (>=0.1.0 <=0.6.1)

bcder CARGO version =0.1.0, =0.1.0, =0.6.0, =0.1.0, =0.8.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.5, =0.3.0, =0.19.0, =0.20.0 and more Source cves: CVE-2023-39914 Source advisory: OSV:GHSA-6JMW-6MXW-W4JC...

HPGO (=0.9.2), algebraics (>=0.1.2 <=0.2.0) +243 more potentially affected by unknown CVE via inventory (>=0.1.10 <=0.1.11)

inventory CARGO version =0.1.10, =0.1.2, =0.11.0, =0.2.0, =0.1.0, =0.6.0, =0.7.0, =0.6.0, =0.5.0, =0.6.0, =0.4.0, =0.6.0, =0.5.0, =0.15.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0057...

Multiple soundness issues in lexical

lexical contains multiple soundness issues: 1. Bytes::read allows creating instances of types with invalid bit patterns 1. BytesIter::read advances iterators out of bounds 1. The BytesIter trait has safety invariants but is public and not marked unsafe 1. writefloat calls MaybeUninit::assumeinit ...

fuse-backend-rs (>=0.10.5 <=0.12.0), linux-loader (>=0.8.0 <=0.9.0) +6 more potentially affected by CVE-2023-41051 via vm-memory (>=0.10.0 <=0.11.0)

vm-memory CARGO version =0.10.0, =0.10.5, =0.8.0, =0.6.0, =0.8.0, =0.7.0, =0.4.0, =0.2.0, =1.5.1, =1.6.1 Source cves: CVE-2023-41051 Source advisory: OSV:GHSA-49HH-FPRX-M68G...

IMAPServer (=0.1.0), actson (>=0.2.0 <=0.3.0) +473 more potentially affected by unknown CVE via lexical (>=2.2.4 <=6.1.1)

lexical CARGO version =2.2.4, =0.2.0, =0.1.0, =0.8.0, =0.1.0, =0.11.0, =0.2.0, =0.1.0, =0.6.0, =0.6.0, =0.6.0, =0.4.0, =0.6.0, =0.15.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0055...

DEBIAN-CVE-2023-40030

Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly arbitrar...

UBUNTU-CVE-2023-40030

Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly arbitrar...

OpenDataSH_twitter_notifier (>=0.1.0 <=0.1.2), a2 (>=0.2.0 <=0.6.2) +3003 more potentially affected by CVE-2018-16875 via webpki (>=0.18.1 <=0.21.4)

webpki CARGO version =0.18.1, =0.1.0, =0.2.0, =0.1.0, =0.2.0-beta.4, =0.1.1, =0.0.1, =0.0.7-alpha.3, =0.0.7-alpha.2, =0.0.7-alpha.1, =0.0.7-alpha.3, =1.0.0, =0.1.0, =0.8.0, =0.1.0, =0.2.2, =2.0.0-alpha.4 and more Source cves: CVE-2018-16875 Source advisory: OSV:RUSTSEC-2023-0052...

RUSTSEC-2023-0103 `postgress` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the malicious user amaperf and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download recor...

RUSTSEC-2023-0101 `oncecell` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the malicious user amaperf and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download recor...